@botonic/dx
Continuous integration for botonic packages
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): Long-lived @botonic org package; no material changes in this version; dormancy consistent with slow release cadence. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established @botonic org package with 81 versions; missing repo URL is a quality gap, not a security signal. | ai | |
| dependencies | unvetted-dep:ts-mockito | AI (dependencies): ts-mockito is a standard TypeScript mocking library; expected in a DX/testing tooling package. | ai | |
| dependencies | unvetted-dep:eslint_d | AI (dependencies): eslint_d is a well-known eslint daemon used as a dev/lint tool; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/jest | AI (phantom-deps): Framework-scoped type package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:jest-junit | AI (phantom-deps): CI reporter declared in config; not a runtime import. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): Build tooling referenced in tsconfig; standard for TS packages. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): Framework-scoped type package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:babel-loader | AI (phantom-deps): Build tooling referenced in config; not a runtime import. | ai | |
| phantom-deps | phantom-dep:@babel/preset-env | AI (phantom-deps): Babel preset loaded by convention via config. | ai | |
| phantom-deps | phantom-dep:identity-obj-proxy | AI (phantom-deps): Jest config mock; not a runtime import. | ai | |
| phantom-deps | phantom-dep:@babel/preset-react | AI (phantom-deps): Babel preset loaded by convention via config. | ai | |
| phantom-deps | phantom-dep:eslint-config-prettier | AI (phantom-deps): ESLint config plugin; not a runtime import. | ai | |
| phantom-deps | phantom-dep:jest-environment-jsdom | AI (phantom-deps): Jest environment declared in config; not a runtime import. | ai | |
| phantom-deps | phantom-dep:@babel/preset-typescript | AI (phantom-deps): Babel preset loaded by convention via config. | ai | |
| phantom-deps | phantom-dep:babel-plugin-add-module-exports | AI (phantom-deps): Babel plugin referenced in config; not a runtime import. | ai | |
| phantom-deps | phantom-dep:eslint-import-resolver-typescript | AI (phantom-deps): ESLint resolver plugin referenced in config; not a runtime import. | ai | |
| phantom-deps | phantom-dep:jest-each | AI (phantom-deps): Dev tooling declared for jest config; not a runtime import, stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:nodemon | AI (phantom-deps): Dev tooling package; nodemon referenced in config — expected pattern. | ai | |
| phantom-deps | phantom-dep:ts-node | AI (phantom-deps): Dev tooling package; ts-node used via npm scripts — expected pattern. | ai | |
| phantom-deps | phantom-dep:prettier | AI (phantom-deps): Dev tooling package; prettier used via npm scripts — expected pattern. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit TypeScript runtime dependency; stable false positive. | ai | |
| phantom-deps | phantom-dep:ts-mockito | AI (phantom-deps): Test tooling referenced in config files — expected pattern for dev tooling package. | ai | |
| phantom-deps | phantom-dep:@botonic/eslint-config | AI (phantom-deps): Same org scope; referenced in eslint config — expected pattern. | ai | |
| phantom-deps | phantom-dep:@botonic/dx-bundler-rspack | AI (phantom-deps): Same org scope; peer/optional dep pattern — expected. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): Scoped @botonic/dx package; 2-edit Levenshtein match to 'qs' is not a credible typosquat. | ai | |
| phantom-deps | phantom-dep:eslint_d | AI (phantom-deps): Dev tooling package; eslint_d used via npm scripts, not direct import — expected pattern. | ai | |
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): Dev tooling package; eslint referenced in config files — expected pattern. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped @botonic/dx package; 2-edit Levenshtein match to 'pg' is not a credible typosquat. | ai | |
| phantom-deps | phantom-dep:jest | AI (phantom-deps): Dev tooling package; jest referenced in config files, not directly imported — expected pattern. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 0.49.0 | 26 / 0 | |
| 0.47.0 | 26 / 0 | |
| 0.46.0 | 26 / 0 | |
| 0.45.0 | 26 / 0 | |
| 0.42.0 | 27 / 0 | |
| 0.41.0 | 27 / 0 | |
| 0.36.0 | 27 / 0 | |
| 0.35.1 | 27 / 0 | |
| 0.35.0 | 27 / 0 |
v0.49.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.47.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.45.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.42.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.36.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.35.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (team.platform) than the most recent previously approved version (oraventos) on 2025-05-13, but team.platform is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.35.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.